August 2020 - sssd-devel - Fedora mailing-lists

[sssd PR#5246][-Changes requested] Drop support of libnss as a crypto backend
by alexey-tikhonov 24 Aug '20

24 Aug '20

URL: https://github.com/SSSD/sssd/pull/5246 Title: #5246: Drop support of libnss as a crypto backend Label: -Changes requested

1 0

[sssd PR#5246][+Waiting for review] Drop support of libnss as a crypto backend
by alexey-tikhonov 24 Aug '20

24 Aug '20

URL: https://github.com/SSSD/sssd/pull/5246 Title: #5246: Drop support of libnss as a crypto backend Label: +Waiting for review

1 0

[sssd PR#5246][comment] Drop support of libnss as a crypto backend
by alexey-tikhonov 24 Aug '20

24 Aug '20

URL: https://github.com/SSSD/sssd/pull/5246 Title: #5246: Drop support of libnss as a crypto backend alexey-tikhonov commented: """ > There is just a left over call to `WITH_CRYPTO` macro on configure.ac. Since you removed the macro this should be removed as well. Thanks for the catch. Fixed. """ See the full comment at https://github.com/SSSD/sssd/pull/5246#issuecomment-678977171

1 0

[sssd PR#5284][opened] Remove leftover ccache from SSH credentials delegation
by justin-stephenson 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5284 Author: justin-stephenson Title: #5284: Remove leftover ccache from SSH credentials delegation Action: opened PR body: """ This PR addresses the issue described in https://github.com/SSSD/sssd/pull/876#issuecomment-525734063 When KCM receives delegated credentials over SSH, a new ccache is initialized, filled in and switched to. If a ccache for this newly initialized principal already exists, an expired/stale ccache gets leftover in the cache. KCM will now compare this newly initialized principal against all existing ccache principals and remove any comparison match, ensuring KCM doesn't end up with a duplicate old ccache. I believe this finalizes the remaining work needed to resolve https://pagure.io/SSSD/sssd/issue/4017 (the main work being done in https://github.com/SSSD/sssd/pull/736 and https://github.com/SSSD/sssd/pull/876) but I would like to have someone confirm this. A simple reproducer case is the following: ~~~ # kinit $user # ssh -K -l $user hostname klist -A # ssh -K -l $user hostname klist -A ~~~ Without this PR each successive run of the ssh command would generate and store a new ccache in KCM on the host *hostname*, and that will be evident in the `klist -A` output. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5284/head:pr5284 git checkout pr5284

3 13

[sssd PR#5178][comment] ldap: add new option ldap_library_debug_level
by alexey-tikhonov 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5178 Title: #5178: ldap: add new option ldap_library_debug_level alexey-tikhonov commented: """ > as I said I'd prefer to use a separate option for this because in more or less all cases this debug output is not needed and -1 is very verbose. So I think `"yet another one knob only few developers will be aware of"` is completely find here because it should be only used if there are strong indications that something is wrong on the libldap level. Ok. """ See the full comment at https://github.com/SSSD/sssd/pull/5178#issuecomment-678344292

1 0

[sssd PR#5241][comment] GPO: respect ad_gpo_implicit_deny when evaluation rules
by sumit-bose 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5241 Title: #5241: GPO: respect ad_gpo_implicit_deny when evaluation rules sumit-bose commented: """ > I can't reproduce this. I have two users 1) Administrator, 2) vagrant. I allow access to the Administrator. Administrator is allowed to login as expected, vagrant is not able to login either way regardless on the option settings because an applicable gpo is found and the user is not explicitly allowed. Hi, the issue happens when there is no allow rule, i.e. RemoteInteractiveLogonRight is empty. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/5241#issuecomment-678307489

1 0

[sssd PR#5178][comment] ldap: add new option ldap_library_debug_level
by sumit-bose 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5178 Title: #5178: ldap: add new option ldap_library_debug_level sumit-bose commented: """ Hi, as I said I'd prefer to use a separate option for this because in more or less all cases this debug output is not needed and -1 is very verbose. So I think `"yet another one knob only few developers will be aware of"` is completely find here because it should be only used if there are strong indications that something is wrong on the libldap level. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/5178#issuecomment-678295717

1 0

[sssd PR#5241][comment] GPO: respect ad_gpo_implicit_deny when evaluation rules
by pbrezina 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5241 Title: #5241: GPO: respect ad_gpo_implicit_deny when evaluation rules pbrezina commented: """ I can't reproduce this. I have two users 1) Administrator, 2) vagrant. I allow access to the Administrator. Administrator is allowed to login as expected, vagrant is not able to login either way regardless on the option settings because an applicable gpo is found and the user is not explicitly allowed. ``` (2020-08-21 15:36:40): [be[ad.vm]] [sysdb_gpo_store_gpo_result_setting] (0x0400): Storing setting: key [SeRemoteInteractiveLogonRight] value [*S-1-5-21-433998187-2822908608-1404606238-500] (2020-08-21 15:36:40): [be[ad.vm]] [sysdb_gpo_get_gpo_result_setting] (0x0400): key [SeRemoteInteractiveLogonRight] value [*S-1-5-21-433998187-2822908608-1404606238-500] (2020-08-21 15:36:40): [be[ad.vm]] [sysdb_gpo_get_gpo_result_setting] (0x0400): key [SeDenyRemoteInteractiveLogonRight] value [(null)] (2020-08-21 15:36:40): [be[ad.vm]] [parse_policy_setting_value] (0x0400): No value for key [SeDenyRemoteInteractiveLogonRight] found in gpo result (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): RESULTANT POLICY: (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): gpo_map_type: Remote Interactive (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): allowed_size = 1 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): allowed_sids[0] = S-1-5-21-433998187-2822908608-1404606238-500 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): denied_size = 0 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): CURRENT USER: (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): user_sid = S-1-5-21-433998187-2822908608-1404606238-1000 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): group_sids[0] = S-1-5-21-433998187-2822908608-1404606238-513 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): group_sids[1] = S-1-5-11 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): POLICY DECISION: (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): access_granted = 0 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_access_check] (0x0400): access_denied = 0 (2020-08-21 15:36:40): [be[ad.vm]] [ad_gpo_perform_hbac_processing] (0x0040): GPO access check failed: [1432158236](Host Access Denied) ``` The patch does not change the behavior. """ See the full comment at https://github.com/SSSD/sssd/pull/5241#issuecomment-678295162

1 0

[sssd PR#5178][comment] ldap: add new option ldap_library_debug_level
by pbrezina 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5178 Title: #5178: ldap: add new option ldap_library_debug_level pbrezina commented: """ I just used this patch to debug something and it works as expected. The SSSD debug level is a bitmask and the idea behind it is that you can enable or disable specific messages. So we can certainly add SSSDDBG_EXTERNAL_LDAP or something and enable -1 ldap level if this is set. But I'm fine with the option as well, especially if you think that something else then -1 (enable all) is helpful. """ See the full comment at https://github.com/SSSD/sssd/pull/5178#issuecomment-678257102

1 0

[sssd PR#5234][+Changes requested] pam: use requested_domains to restrict cache_req searches
by pbrezina 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5234 Title: #5234: pam: use requested_domains to restrict cache_req searches Label: +Changes requested

1 0

[sssd PR#5246][+Changes requested] Drop support of libnss as a crypto backend
by pbrezina 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5246 Title: #5246: Drop support of libnss as a crypto backend Label: +Changes requested

1 0

[sssd PR#5246][-Waiting for review] Drop support of libnss as a crypto backend
by pbrezina 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5246 Title: #5246: Drop support of libnss as a crypto backend Label: -Waiting for review

1 0

[sssd PR#5246][comment] Drop support of libnss as a crypto backend
by pbrezina 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5246 Title: #5246: Drop support of libnss as a crypto backend pbrezina commented: """ Works as expected. There is just a left over call to `WITH_CRYPTO` macro on configure.ac. Since you removed the macro this should be removed as well. """ See the full comment at https://github.com/SSSD/sssd/pull/5246#issuecomment-678251761

1 0

[sssd PR#5280][opened] p11_child: switch default ocsp_dgst to sha1
by alexey-tikhonov 21 Aug '20

21 Aug '20

URL: https://github.com/SSSD/sssd/pull/5280 Author: alexey-tikhonov Title: #5280: p11_child: switch default ocsp_dgst to sha1 Action: opened PR body: """ For details please see discussion at https://github.com/SSSD/sssd/pull/837#issuecomment-672831519 Resolves: https://github.com/SSSD/sssd/issues/5002 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5280/head:pr5280 git checkout pr5280

4 20

[sssd PR#5267][opened] Got rid of ".tx" and "zanata.xml" due to migration to Weblate.
by alexey-tikhonov 20 Aug '20

20 Aug '20

URL: https://github.com/SSSD/sssd/pull/5267 Author: alexey-tikhonov Title: #5267: Got rid of ".tx" and "zanata.xml" due to migration to Weblate. Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5267/head:pr5267 git checkout pr5267

3 25

[sssd PR#5260][opened] config: allow prompting options in configuration
by ikerexxe 20 Aug '20

20 Aug '20

URL: https://github.com/SSSD/sssd/pull/5260 Author: ikerexxe Title: #5260: config: allow prompting options in configuration Action: opened PR body: """ False warnings were logged after enabling prompting options in configuration file. This change modifies the configuration rules to allow prompting options. Resolves: https://github.com/SSSD/sssd/issues/5259 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5260/head:pr5260 git checkout pr5260

3 14

[sssd PR#5279][opened] man: clarify AD certificate rule
by ikerexxe 20 Aug '20

20 Aug '20

URL: https://github.com/SSSD/sssd/pull/5279 Author: ikerexxe Title: #5279: man: clarify AD certificate rule Action: opened PR body: """ Clarify AD specific certificate rule example by changing userPrincipal to userPrincipalName. Moreover, match the subject principal name in the example with the rule name. Resolves: https://github.com/SSSD/sssd/issues/5278 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5279/head:pr5279 git checkout pr5279

3 10

[sssd PR#5271][opened] Translations update from Weblate
by weblate 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/5271 Author: weblate Title: #5271: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/sssd/sssd-master/) for SSSD/sssd. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5271/head:pr5271 git checkout pr5271

2 4

[sssd PR#5258][opened] Translations update from Weblate
by weblate 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/5258 Author: weblate Title: #5258: Translations update from Weblate Action: opened PR body: """ Translations update from [Weblate](https://translate.fedoraproject.org/projects/sssd/sssd/) for SSSD/sssd. """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5258/head:pr5258 git checkout pr5258

4 11

[sssd PR#5241][+Waiting for review] GPO: respect ad_gpo_implicit_deny when evaluation rules
by sumit-bose 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/5241 Title: #5241: GPO: respect ad_gpo_implicit_deny when evaluation rules Label: +Waiting for review

1 0

[sssd PR#5241][comment] GPO: respect ad_gpo_implicit_deny when evaluation rules
by sumit-bose 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/5241 Title: #5241: GPO: respect ad_gpo_implicit_deny when evaluation rules sumit-bose commented: """ Hi, in a private comment in https://bugzilla.redhat.com/show_bug.cgi?id=1855323 it was confirmed that the patch works as expected. bye, Sumit """ See the full comment at https://github.com/SSSD/sssd/pull/5241#issuecomment-675472568

1 0

[sssd PR#837][opened] p11_child: make OCSP digest configurable
by sumit-bose 18 Aug '20

18 Aug '20

URL: https://github.com/SSSD/sssd/pull/837 Author: sumit-bose Title: #837: p11_child: make OCSP digest configurable Action: opened PR body: """ Currently sha1 is used to create the certid for an OCSP request. Since sha1 is not recommend for new applications anymore and not FIPS compliant this patch changes the default to sha256 and makes the digest function configurable as well. Related to https://pagure.io/SSSD/sssd/issue/4032 """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/837/head:pr837 git checkout pr837

6 36

[PATCHES] Fix compilation with check 0.15.1
by Lukas Slebodnik 18 Aug '20

18 Aug '20

ehlo, new version introduced checking format string and thus it is not possible to use fail_if/fail_unless without msg parameter. PTAL LS

3 3

[sssd PR#5266][opened] BE_REFRESH: Do not try to refresh domains from other backends (1-16)
by alexey-tikhonov 12 Aug '20

12 Aug '20

URL: https://github.com/SSSD/sssd/pull/5266 Author: alexey-tikhonov Title: #5266: BE_REFRESH: Do not try to refresh domains from other backends (1-16) Action: opened PR body: """ We cannot refresh domains from different sssd_be processes. We can refresh just subdomains Resolves: https://pagure.io/SSSD/sssd/issue/4142 Merges: https://pagure.io/SSSD/sssd/pull-request/4139 Reviewed-by: Sumit Bose <sbose(a)redhat.com> (cherry picked from commit 007d5b79b7aef67dd843ed9a3b65095faaeb580f) """ To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5266/head:pr5266 git checkout pr5266

3 11

[sssd PR#5182][-Accepted] AD: Enforcing GPO rule restriction on user
by pbrezina 12 Aug '20

12 Aug '20

URL: https://github.com/SSSD/sssd/pull/5182 Title: #5182: AD: Enforcing GPO rule restriction on user Label: -Accepted

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2020